Polish documentation and security boundaries

[YusefSyed]

What changed

• rewrote the README to state exactly what the tool records and what it cannot prove
• removed the misleading unpublished npx command and redundant lint/type-check duplication
• added complete package metadata and marked the package private to prevent accidental publication
• expanded credential redaction coverage for current OpenAI and GitHub token formats

Why

The public repository should be concise, technically accurate and safe for recruiters or engineers to evaluate without overstated claims.

Validation

• npm run typecheck
• npm test — 5/5 passing
• npm run example
• npm audit — 0 vulnerabilities
• git diff --check